Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

suatcini54 · 2026-10-14T06:59:13-0400

Monika1491 said:
update, update, update...
PowerShell 7.6.6 is not up to date.
The current version is PowerShell 7.6.7

Thank you, Monika.

I use WinGet in a.bat file to update Windows Apps. Not all, of course. But PowerShell update is included in WinGet. I checked updates on Monday but there was not a single update in WinGet's radar. Today I checked again thanks to you and I caught three updates. But somehow PowerShell is not updated. I am surprised twice today. One surprise came from you and the other, from WinGet.

For info for those members interested: The .bat file includes the following lines and it is run in admin mode.

start %comspec% /C
pwsh.exe -Command "winget upgrade --all --include-unknown --accept-source-agreements --accept-package-agreements"

suatcini54 · 2026-10-14T07:04:29-0400

I ran WinGet again and now I know what was wrong.

suatcini54 · 2026-10-14T07:08:53-0400

Microsoft page still has PowerShell 7.6.6

Monika1491 · 2026-10-14T08:06:42-0400

suatcini54 said:
Microsoft page still has PowerShell 7.6.6

View attachment 186576

I use

Releases · PowerShell/PowerShell

PowerShell for every system! Contribute to PowerShell/PowerShell development by creating an account on GitHub.

github.com

for example

https://github.com/PowerShell/PowerShell/releases/download/v7.6.7/PowerShell-7.6.7-win-x64.zip

The files are in the PowerShell folder, which is located in APPDATA.
The PowerShell folder is in the user's PATH.
And since yesterday (CEST, UTC+2), I’ve been using PowerShell 7.6.7.

TheVisitor · 2026-10-14T08:12:18-0400

I got the Powershell update overnight from the MS store automagically

hader · 2026-10-14T08:59:06-0400

@garlin
Thanks again for the recent update!

If anybody downloads the SecureBoot-CA-2023-Updates.v2026.10.08.zip file. Check it's properties. At a certain build it could say: Remove Block.
Remove the Block and then unzip the file. Otherwise every .ps1 file will have that Block signature also and prevents it from running using PS as admin.

Still a question: I see with Check_DBXUpdate.bin.ps1 the following result;

Code:

SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdate2024.bin"
FAILED: Missing 1/3 SVN signatures from "DBXUpdateSVN.bin"

You refer that I can download a more recent file from MS Github. I can not find that file. Is there a link to it??
By what of way is that updated normally? By a more recent update? (I have just now update 26300.9711 pending) Maybe it's in there....

nikki605 · 2026-10-14T09:32:13-0400

After yesterdays update, this looks good, but see the problem at the end....

C:\Scripts\Check-UEFI.bat -Verbose -Audit
Windows 11 26H2 (26300.9711)
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
LENOVO 20N20028US
Version: N2IETA7W (1.85 )
Date: 2026-04-06

Factory Default UEFI PK Cert
----------------------------
Lenovo Ltd. PK CA 2012

UEFI PK Cert
------------
Mosby Generated PK [2026.09.29]

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
Lenovo Ltd. KEK CA 2012
Microsoft Corporation KEK 2K CA 2023

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
ThinkPad Product CA 2012
Lenovo UEFI CA 2014
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DB Certs
-------------
MosbyKey [2026.09.29]
Microsoft Corporation UEFI CA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
Debian Secure Boot Signer
Canonical Ltd. Secure Boot Signing
EFI_CERT_SHA256_GUID Signatures: 894

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 12.0
EFI_CERT_SHA256_GUID Signatures: 299

UEFI Variables
--------------
Credential Guard: ON
SBAT (Linux only): sbat,1,2025112400 / shim,4 / grub,6

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume2\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.376, SVN 12.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

AUDIT REPORT
============

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is missing from EFI

STATUS REPORT
-------------
Scheduled Task: "Secure-Boot-Update" is Ready.

Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS C:\Scripts>

But this is a problem...

C:\Scripts\Check-DBX.bat
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
No DBX signatures in C:\Windows\System32\SecureBootUpdates\DBXUpdate2024.bin
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\Scripts>

suatcini54 · 2026-10-14T09:45:07-0400

@Monika1491 Thanks. Got it.

Dirtyflash · 2026-10-14T09:55:03-0400

nikki605 said:
After yesterdays update, this looks good, but see the problem at the end....

C:\Scripts\Check-UEFI.bat -Verbose -Audit
Windows 11 26H2 (26300.9711)
Secure Boot: ON
Virtualization Based Security: ON
BitLocker on (C:) OFF

BIOS Firmware
-------------
LENOVO 20N20028US
Version: N2IETA7W (1.85 )
Date: 2026-04-06

Factory Default UEFI PK Cert
----------------------------
Lenovo Ltd. PK CA 2012

UEFI PK Cert
------------
Mosby Generated PK [2026.09.29]

Factory Default UEFI KEK Certs
------------------------------
Microsoft Corporation KEK CA 2011
Lenovo Ltd. KEK CA 2012
Microsoft Corporation KEK 2K CA 2023

UEFI KEK Certs
--------------
Microsoft Corporation KEK CA 2011
Microsoft Corporation KEK 2K CA 2023

Factory Default UEFI DB Certs
-----------------------------
Microsoft Corporation UEFI CA 2011
Microsoft Windows Production PCA 2011
ThinkPad Product CA 2012
Lenovo UEFI CA 2014
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

UEFI DB Certs
-------------
MosbyKey [2026.09.29]
Microsoft Corporation UEFI CA 2011
Microsoft Option ROM UEFI CA 2023
Microsoft UEFI CA 2023
Windows UEFI CA 2023

Factory Default UEFI DBX Certs
------------------------------
Debian Secure Boot Signer
Canonical Ltd. Secure Boot Signing
EFI_CERT_SHA256_GUID Signatures: 894

UEFI DBX Certs
--------------
Microsoft Windows Production PCA 2011
Windows BootMgr SVN 12.0
EFI_CERT_SHA256_GUID Signatures: 299

UEFI Variables
--------------
Credential Guard: ON
SBAT (Linux only): sbat,1,2025112400 / shim,4 / grub,6

EFI Files
---------
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
\\.\HarddiskVolume2\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.376, SVN 12.0

Registry: "WindowsUEFICA2023Capable" = 2
[Windows UEFI CA 2023] in UEFI DB, and Windows starting from CA 2023 Boot Manager.

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is MISSING.

AUDIT REPORT
============

[OPTIONAL] SkuSiPolicy.p7b (for VBS) is missing from EFI

STATUS REPORT
-------------
Scheduled Task: "Secure-Boot-Update" is Ready.

Registry: "UEFICA2023Status" = Updated

SUCCESS: UPDATES ARE FINISHED.
UEFI CA 2023 certs are present, PCA 2011 cert is revoked.

PS C:\Scripts>

But this is a problem...

C:\Scripts\Check-DBX.bat
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
No DBX signatures in C:\Windows\System32\SecureBootUpdates\DBXUpdate2024.bin
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

PS C:\Scripts>

See Garlin's #3973 post. Running the Check script with -Verbose would have likely shown you the same thing.

TheVisitor · 2026-10-14T10:21:58-0400

OK, ran Update-UEFI.bat and still get the DNX error

PS C:\Temp27> powershell -nop -ep bypass -f C:\temp27\check_dbxupdate.bin.ps1 -verbose -audit
SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
No DBX signatures in C:\WINDOWS\System32\SecureBootUpdates\DBXUpdate2024.bin
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

gunrunnerjohn · 2026-10-14T10:25:35-0400

Will the firmware SVN eventually level itself with the Boot Manager or do I have to do a manual update?

Looks like this exists on more than one computer here.

TheVisitor · 2026-10-14T10:28:42-0400

gunrunnerjohn said:
Will the firmware SVN eventually level itself with the Boot Manager or do I have to do a manual update?

View attachment 186606

Looks like this exists on more than one computer here.

View attachment 186608

Mine updated:

PS C:\Temp27> get-securebootsvn

FirmwareSVN : 12.0
BootManagerSVN : 12.0
StagedSVN : 12.0
ComplianceStatus : Compliant (Boot Manager SVN meets staged SVN)
BootManagerPath : \\.\HarddiskVolume1\EFI\Microsoft\Boot\bootmgfw.efi

TheVisitor · 2026-10-14T10:40:28-0400

How to fix boot.wim1

Hasleo 5.9.2.4
--------------
WinPE Boot Manager [Windows UEFI CA 2023] is ALLOWED.
C:\Program Files\Hasleo\Hasleo Backup Suite\bin\WADK\Boot\EFI_EX\bootmgfw.efi
File Version: 28000.376, SVN 12.0

Bootable Media
--------------

USB Drive G: "HASLEOBS"
Boot File [Windows UEFI CA 2023] is ALLOWED.
G:\EFI\Boot\bootx64.efi
File Version: 28000.376, SVN 12.0

boot.wim:1 (WinPE 26100.1)
Boot Manager [Windows UEFI CA 2023] is BANNED.
\Windows\Boot\EFI_EX\bootmgfw_EX.efi
File Version: 28000.367, SVN 11.0

\Windows\System32\winload.efi is ALLOWED.
File Version: 26100.1

hader · 2026-10-14T11:15:06-0400

hader said:
@garlin
Thanks again for the recent update!

If anybody downloads the SecureBoot-CA-2023-Updates.v2026.10.08.zip file. Check it's properties. At a certain build it could say: Remove Block.
Remove the Block and then unzip the file. Otherwise every .ps1 file will have that Block signature also and prevents it from running using PS as admin.

Still a question: I see with Check_DBXUpdate.bin.ps1 the following result;

Code:

SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin" SUCCESS: Matched 3/3 SVN signatures from "DBXUpdate2024.bin" FAILED: Missing 1/3 SVN signatures from "DBXUpdateSVN.bin"

You refer that I can download a more recent file from MS Github. I can not find that file. Is there a link to it??
By what of way is that updated normally? By a more recent update? (I have just now update 26300.9711 pending) Maybe it's in there....

Just updated to 26300.9711 and ran Check-UEFI.bat. At the end of the script (everything was OK) it said
Place \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecureBoot\AvialiableUpdates: 0x200 and start \Microsoft\Windows\PI\Secure-Boot-Update inside the taskschedular to update.

It did that and after running Check-DBX.bat it gave me the following result;

Code:

SUCCESS: Matched 291/291 EFI signatures from "dbxupdate.bin"
No DBX signatures in C:\WINDOWS\System32\SecureBootUpdates\DBXUpdate2024.bin
SUCCESS: Matched 3/3 SVN signatures from "DBXUpdateSVN.bin"

The file DBXUpdate2024.bin inside the directory SecureBootUpdates and dates from 14-10-2026 (today, by this latest 9711 update)
Does this mean there is something wrong with your script? (MS has changed the DBX structure inside that new DBXUpdate2024. bin file?) With the previous run this check was marked with SUCCESS.....

Well at least my SVN is up-to-date now.
Strange. Cjee21's Github script (d.d. 08-2026) report nothing wrong; (at this moment now Github has an old script d.d. 04-2026 that contains only 1 .ps1 script and for the rest nothing. His script from 08-2026 was very extensive with many .ps1 files.)

Code:

------------------------------------------------------------
HW : ASUS - ASUSTeK COMPUTER INC. PRIME Z690-A
FW : American Megatrends Inc. - 4505 - 29 nov 2025
OS : Windows 11 - 26H2 (Build 26300.9711)

Detected AMD64/X64 UEFI architecture. Ensure that this is correct for valid DBX results.

Secure Boot status: Enabled

Current UEFI PK
√ ASUSTeK MotherBoard PK Certificate

Default UEFI PK
√ ASUSTeK MotherBoard PK Certificate

Current UEFI KEK
√ Microsoft Corporation KEK CA 2011 (revoked: false)
√ Microsoft Corporation KEK 2K CA 2023 (revoked: false)
√ ASUSTeK MotherBoard KEK Certificate (revoked: false)

Default UEFI KEK
√ Microsoft Corporation KEK CA 2011 (revoked: false)
√ Microsoft Corporation KEK 2K CA 2023 (revoked: false)
√ ASUSTeK MotherBoard KEK Certificate (revoked: false)

Current UEFI DB
√ Microsoft Windows Production PCA 2011 (revoked: true)
√ Microsoft Corporation UEFI CA 2011 (revoked: false)
√ Windows UEFI CA 2023 (revoked: false)
√ Microsoft UEFI CA 2023 (revoked: false)
√ Microsoft Option ROM UEFI CA 2023 (revoked: false)
√ ASUSTeK MotherBoard SW Key Certificate (revoked: false)
√ ASUSTeK Notebook SW Key Certificate (revoked: false)
√ SHA256: F58FBDF71BE8C37CBBD6944E472C450B1043817B972914487C221033F3079E43
√ SHA256: 04970157DE52CDAE14CF17EE369881D6245B3A6AB6352EABAEE588A0584B0303
√ SHA256: F16B5FC361183F587120E602C0D65773AFDFE786124184FA70805258D76D594C
√ SHA256: 7E021F15E3A67B75ACE884999BEDFFE34213792A611E40E562E87E6B9A0CB282
√ SHA256: A5D109B2AFA3FA90878F70382B2388FCD2FEAEAE8A51B80ADD048E9F876B2A4E

Default UEFI DB
√ Microsoft Windows Production PCA 2011 (revoked: true)
√ Microsoft Corporation UEFI CA 2011 (revoked: false)
√ Windows UEFI CA 2023 (revoked: false)
√ Microsoft UEFI CA 2023 (revoked: false)
√ Microsoft Option ROM UEFI CA 2023 (revoked: false)
√ ASUSTeK MotherBoard SW Key Certificate (revoked: false)
√ ASUSTeK Notebook SW Key Certificate (revoked: false)
√ SHA256: F58FBDF71BE8C37CBBD6944E472C450B1043817B972914487C221033F3079E43
√ SHA256: 04970157DE52CDAE14CF17EE369881D6245B3A6AB6352EABAEE588A0584B0303
√ SHA256: F16B5FC361183F587120E602C0D65773AFDFE786124184FA70805258D76D594C
√ SHA256: 7E021F15E3A67B75ACE884999BEDFFE34213792A611E40E562E87E6B9A0CB282
√ SHA256: A5D109B2AFA3FA90878F70382B2388FCD2FEAEAE8A51B80ADD048E9F876B2A4E

Current UEFI DBX
√ Microsoft Windows Production PCA 2011
2026-06-09 (v1.6.5) [AMD64] : SUCCESS: 443 successes detected
2026-07-14 [AMD64]          : SUCCESS: 291 successes detected
Windows BootMgr SVN         : 12.0
Windows CDBoot SVN          : 3.0
Windows WDSMgFw SVN         : 3.0
Statistics                  : 445 SHA256 hashes, 1 X.509 certs, 7 SVNs

Size statistics (Bytes)
PK                          : 886
KEK                         : 3955
db                          : 9691
dbx                         : 23519
SetupMode                   : 1
SecureBoot                  : 1
dbt                         : 0 or unable to determine
Total size                  : 38053
PKDefault                   : 886
KEKDefault                  : 3955
dbDefault                   : 9691
dbxDefault                  : 20668
dbtDefault                  : 0 or unable to determine
Total default size          : 35200

itsme1 · 2026-10-14T11:42:30-0400

gunrunnerjohn said:
Will the firmware SVN eventually level itself with the Boot Manager or do I have to do a manual update?

View attachment 186606

Looks like this exists on more than one computer here.

View attachment 186608

Your SVN versions 8.0 and 9.0 are outdated, if Windows had updated them automatically, they would be at version 11(and then 12 with the latest KB).

To update them, run the following commands in an Administrator Command Prompt:

Code:

reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Secureboot /v AvailableUpdates /t REG_DWORD /d 0x200 /f

Code:

Start-ScheduledTask -TaskName "\Microsoft\Windows\PI\Secure-Boot-Update"

Restart the computer and wait about 5 minutes before checking.

Edit: Ignore the error associated with the second command.

garlin · 2026-10-14T12:00:59-0400

The latest change in the Oct 2026 CU drops the baseline SVN's that were included in DBXUpdate2024.bin and leaves DBXUpdateSVN.bin as the only file where the SVN's are added from.

When MS originally created DBXUpdate2024.bin, it served two functions. The file contained a copy of PCA 2011 cert so it could be added to the DBX (banning the same cert) and a baseline set of SVN's. If you banned PCA 2011 using the MS method, you got a "starting" set of SVN's. The intention was always to apply the more recent DBXUpdateSVN.bin to reach the final SVN number.

You don't actually need both files to contain a SVN, because the DBXUpdate2024.bin version was always behind. MS was pushing a base SVN, which got superseded by a newer SVN. This can be considered a waste of effort. But that's how they rolled out the system over a year ago.

Now they've decided to make DBXUpdate2024.bin's only purpose to ban PCA 2011 and nothing more.

Check_DBXUpdate.bin.ps1 is designed to compare a DBX .bin file against what your current UEFI's DBX variable holds. Since there are no EFI signatures in the October version, the script is correct in reporting. What is important is we have one set of scripts for all Windows releases, and some End-of-Life releases stopped getting newer Secure Boot files over a year ago. They still need full reporting on their DBX files.

What I'm changing in the next script version, is the message will not be printed in RED text if the script is scanning DBXUpdate2024.bin. This allows the same script to work for all Windows versions I support.

nikki605 · 2026-10-14T12:07:10-0400

@garlin After installing yesterdays MS updates I was left with this problem running the Check-DBX.bat script:

garlin said:
The latest change in the Oct 2026 CU drops the baseline SVN's that were included in DBXUpdate2024.bin and leaves DBXUpdateSVN.bin as the only file where the SVN's are added from.

When MS originally created DBXUpdate2024.bin, it served two functions. The file contained a copy of PCA 2011 cert so it could be added to the DBX (banning the same cert) and a baseline set of SVN's. If you banned PCA 2011 using the MS method, you got a "starting" set of SVN's. The intention was always to apply the more recent DBXUpdateSVN.bin to reach the final SVN number.

You don't actually need both files to contain a SVN, because the DBXUpdate2024.bin version was always behind. MS was pushing a base SVN, which got superseded by a newer SVN. This can be considered a waste of effort. But that's how they rolled out the system over a year ago.

Now they've decided to make DBXUpdate2024.bin's only purpose to ban PCA 2011 and nothing more.

Check_DBXUpdate.bin.ps1 is designed to compare a DBX .bin file against what your current UEFI's DBX variable holds. Since there are no EFI signatures in the October version, the script is correct in reporting. What is important is we have one set of scripts for all Windows releases, and some End-of-Life releases stopped getting newer Secure Boot files over a year ago. They still need full reporting on their DBX files.

What I'm changing in the next script version, is the message will not be printed in RED text if the script is scanning DBXUpdate2024.bin. This allows the same script to work for all Windows versions I support.

Is that why I am getting this:

garlin · 2026-10-14T12:10:05-0400

Yes. This is why I have to wait for every Patch Tuesday, to see what wonderful surprises MS makes. From an user's point of view, nothing important has changed. But the script has to keep pace.

nikki605 · 2026-10-14T12:15:26-0400

Well, at least something went right. I got PS 7.6.7 and all SVN are 12.0. :winkt:

nikki605 · 2026-10-14T12:17:09-0400

garlin said:
Yes. This is why I have to wait for every Patch Tuesday, to see what wonderful surprises MS makes. From an user's point of view, nothing important has changed. But the script has to keep pace.

Okay. Then I won't worry about it. I'll just wait for you to update the script. Thanks!

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computer My Computer

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Well-known member

My Computers My Computers

At a glance

At a glance

Similar threads

My Computers

My Computers

My Computers

My Computer

My Computer

My Computers

My Computers

My Computers

My Computer

My Computer

My Computers

My Computer

My Computer

My Computers

My Computer

My Computer

My Computers

My Computer

My Computers

My Computers